FrankenPHP improperly handles Unicode characters during case conversion in its CGI path splitting logic. It calculates the index for the .php marker on a lowercased copy of the request path, but uses that byte offset against the original string. Because Go’s ToLower can increase the byte length of certain UTF‑8 characters, the computed index may be misaligned, causing an incorrect SCRIPT_NAME and SCRIPT_FILENAME. This misinterpretation allows an attacker to trigger the execution of a file other than the one referenced by the request URI, effectively enabling arbitrary code execution within the server context.

The vulnerability affects the PHP FrankenPHP application server published by php:frankenphp. All releases prior to version 1.11.2 are susceptible; the issue was fixed in the 1.11.2 release. No specific sub‑versions are listed, so any installation of FrankenPHP below 1.11.2 should be considered at risk.

The CVSS score of 8.9 indicates high severity. The EPSS score is less than 1 percent, implying that, while exploitable, the probability of widespread exploitation is currently low. FrankenPHP is not listed in the CISA KEV catalog, but the flaw permits remote code execution over an HTTP interface, making it a high‑impact flaw if exploited. Exploitation would require the ability to send crafted HTTP requests to the server, which is typically available to any network user who can reach the application.